skysight-inc/HackerNews huggingface dataset:
Incidentally, after inspecting doas for a few minutes, I found two near-vulnerability bugs in it.

The first bug lets any user cause doas to read out of bounds of an array, though not in a way that's exploitable.

Well, it's arguably a bug in libc. If you run doas with a completely empty argv (argc = 0, so not even an executable name; the two systems I tried, Linux and macOS, both let you do this), getopt will exit with optind = 1. Then when doas does;

argv += optind;
argc -= optind;

`argc` will become negative, and `argv` will advance past the null terminator. On most OSes, the `argv` array is immediately followed in memory by `environ`, so argv will now point to the list of environment variables.

doas will then dereference argv, and generally act as if you tried to execute a command consisting of the environment variables. However, the environment variables are not secret, and doas doesn't behave any differently than if you just passed the environment variables as normal command-line arguments, so this is not exploitable.

On an OS where argv is not followed by environ or a similar array of character pointers, doas might crash instead, although since it only reads from those pointers rather than writing to them, this still probably wouldn't be exploitable.

The second bug would compromise memory safety if things were slightly different. The bug is in configuration file parsing. Even if it did compromise memory safety, it would not actually be exploitable, because doas normally only parses the trusted systemwide configuration file. It can be asked to parse a configuration file passed on the command line, but it drops privileges before doing so. This is a good example of layered defense, so kudos to doas for that! Still, I thought the bug was worth mentioning.

The bug is a traditional sort of integer overflow. parse.y grows the array of rules with

maxrules *= 2;

but maxrules is an int, so this will eventually overflow if the configuration file is large enough.

However, because maxrules happens to be signed, before doubling produces a smaller-than-expected positive value, it will first produce a negative value. This will then get sign-extended when converting to size_t (assuming 32-bit int and 64-bit size_t), and reallocarray's overflow check will trigger, causing reallocarray to return NULL. doas interprets that as out-of-memory and handles it cleanly.

(On a system where sizeof(int) == sizeof(size_t), things are a bit different, but it will just run out of memory before maxrules gets that high.)

Moral of the story? Well, as I see it:

Simplicity and layered defense, both featured in doas, are both effective ways to avoid vulnerabilities. But guaranteed memory safety, which would require a different implementation language, is also an effective way to avoid vulnerabilities. You aren't forced to pick and choose. Why not demand all three?
That's better than I had imagined it was, though I wonder about those on really lousy insurance, or no insurance. Or perhaps those on their parent's insurance that aren't "out" yet, etc.
> Clinton “won” the popular vote with a lower total percentage than Kerry lost the popular vote in 2004.

I sincerely don't understand why "won" is in quotation marks – I think you meant to say "the popular vote isn't something that can be won since we have the electoral college" – and if that's the case, let me clarify that what I mean is that she received a significantly higher number of votes than Trump did.

> The 2 point margin between Trump and Clinton was less than the margin between Bush and Kerry in 2004.

I don't understand the point you're making here.

>> There was ample evidence of the malfeasance being complained about in the 2016 election
> Not in 2017 there wasn’t.

Russian hacking was discussed prominently during the presidential debates in 2016, so I have to disagree with you on that point.

>> The people who complained of a 'stolen' election in 2016 were pushing for reforms
> So were many of the people objecting to the 2020 election

That may be true, but I haven't yet heard a good-faith argument for reforms (or in fact any argument for reforms) from people objecting to the 2020 election, nor any sense of what those reforms would be aside from things that could also be described as voter suppression and demands to reverse the outcome of the presidential, but not the down-ballot, elections. Maybe my sources are bad.
That's the correct way to do this.
Not broccoli
Measuring Slavery in 2016 Dollars
The implication of your post is that Open Source projects are dead projects, which seems obviously false.
How much are 25 individual paid accounts?
Where is calculus?
Thanks. I don't want to get too much into the corporate history but I updated the article to mention that it was formed through merger.
Biology has much to offer for us. There are millions of years of evolution encapsulated in some of the biological form and structures out there.
Sorry, to be clear I was referring to an xckd comic [1] and the Python Easter Egg inspired by it [2].

[1] https://xkcd.com/353/

[2] http://python-history.blogspot.com/2010/06/import-antigravit...
I know of hundreds of customers already running Kubernetes at scale (not just some clusters but hundreds) for applications in production.

Companies running 15000+ containers in production is not rare.

Kubernetes is quite stable and established in many "old skool" banks, insurance companies, governments, etc already.

There are no more software products that remain stable with same API over 20 years. Everything goes faster and faster, you need to adopt or die ;-)
It's 343MB total repo folder size once built. The binary it produces counts for 88MB of that.
BIG-bench: a collaborative language model benchmark from Google and OpenAI
"Lightweight" adds nothing to the description and "job" is ambiguous. I think "nq - queues the execution of background processes" would be a better description.
I work in an organization which is part of a huge multinational. We've successfully managed to spearhead Gitlab into our giant company, and it's slowly making inroads.

until this price change

And now we're looking at alternatives. Sorry, the price hike for our case (~500 devs) is hefty, to the point where we're willing to eat crow and go with Gerrit+Jira+Confluence+Jenkins, and basically disentangle ourselves.

So like, I guess it makes financial sense in the short term? But definitely will hurt in the mid-long term. You've lost us at least as a customer. And no--we aren't going to talk to our account leader about this, or discuss any discounts or anything.
Plus, FF can preserve the value by allowing cross domain resource caching as long as the request specifies a hash.

That negates the super cookie use case, but still lets you eg. load Jquery from a shared CDN.

You get a free security upgrade to go with it.
sudoedit is used by many people, and setting a different shell with -s seems like something that would cover a number of edge cases, yes, but writing a new tool just to add "-s" is obviously silly. Nothing in this particular CVE touches on anything that seems particularly obscure to me.

The last major sudo bug was in the PAM code (which lead to the creation of doas), which is something many people don't need, but also something that many others do need.

And writing separate tools would be the equal (or more!) lines of code and an equal amount of bugs in total (or probably more, since people will be reinventing stuff and there will be fewer reviewers per line of code). This isn't reducing complexity, it's just spreading it out.
Not sure why you are downvoted.

Maybe because your comment is not the assuring "vaccines don't cause autism" and people already chose the assuring narative.

Vaccines do cause a lot of bad stuff, however for mass population it makes sense to vaccinate, as the benefits outweight the drawbacks.
How is it possible that GNU’s `sudo` is not GPL?

Unless it’s BSD, I guess?
Kubernetes is in no way "resume driven" anymore.

It is being used by the largest companies in the world at massive scale, in the public and private cloud.
You can bet your bottom banana that the GRU, the NSA, Chinese state security, and the mob have all thoroughly fuzzed sudo and are sitting on the results.

It just seems SO EASY to add a test for this problem, literally the relevant test input is one slash by itself, or any string ending in a slash! So simple! If I sent a change like this at work, no matter how trivial, that said it fixed this bug but I didn't send any tests, the reviewer would reject it out of hand or, probably, just silently ignore my change. But that's the real problem here. This program is a monograph. There are no reviewers and there are, consequently, no standards.
I don't think "Cloud" matters here. Apps are not created from vacuum, they may link to proprietary code (a lot), not to mention infra dependencies.

E.g., a Google Reader like thing:

* Google internal library dependencies
* Internal storage systems like BigTable
* Borg configurations
* Service dependencies: group management, access control, telemetry....

Basically, the closed enclosure of a service is just too big to open source.
This is why I whitelist Javscript on a per-subdomain basis. I think NoScript does this but I use a simpler extension[0] and then rely on uBlock origin and multi account containers for privacy once I've whitelisted sites.

[0] https://addons.mozilla.org/en-US/firefox/addon/disable-javas...
Great idea, I love the idea of getting real-time transcription of what I'm attempting to play.

As others have commented, it seems to struggle with the low E and A strings of guitar. Thinking about this:

1. The smallest note interval is from open low E (82Hz) up to the next semitone (82*(2^(1/12) -1)), which is about 5Hz. This gives the maximum bin width.

2. The guitar range is approx 4 octaves, ie up to about 330Hz. The min sampling freq must be double this.

3.In practice the bin edges wont line up with the semitone boundaries, so we ought to aim for bin widths smaller than half of 5Hz above, say 2Hz. This guarantees that a bin exists that doesn't cross semitone boundaries.

4. As lower frequencies probably wont be sampled across an integer number of cycles, spectral smearing will occur. This can be reduced by making the binwidth even smaller, and by use of windowing in the time domain.

5. My environment has background noise (eg computer fan). Unless the noise is filtered out pre-sampling (which it probably isn't for most users) then this will fold back into the signal of interest. Sampling at a higher rate than 2 x 330Hz would allow separation of the noise from the signal. I'm not sure what sample rate is used in the app. If the noise goes up to 4kz (I'm guessing) then this implies a sample rate of 8kHz to remove it.

6. From the above: sample at 8kHz for 1 second, use a window funtion to reduce spectral leakage. 8192 samples is a handy power of 2. Smaller sized ffts are likely to struggle to identify the right bin at lower frequencies, and/or have more noise in the signal band to confuse the peak detector.

7. An oscilloscope display would be handy to verify that signal levels were ok, and that noise isn't too intrusive.
Sure, in fact im working on such a solution: https://pirsch.io/
Yep, here's one for an AR-15 chamber lock that I got a couple weeks ago: https://www.facebook.com/watch/?v=364409318216958

I was shocked. What's suburban dad doing getting out of his SUV in a mall parking lot with an AR-15???

Full disclosure: I'm not on the right wing or even remotely close.
Moving by DNS change isn't usually that bad. The old system (load balancer) can proxy requests to the new system. Most clients will follow DNS but the laggers won't have too much trouble. Assuming the service already works behind a load balancer of course, that is usually not something than can be fork-lifted in.
So one could argue that short interest is actually inefficient since it soaks up capital that would have gone into equity raises by a struggling company. I.e. that in a traditional market short sellers function as a sort of reverse pump and dump, preventing an otherwise viable business from raising short term capital and forcing it into bankruptcy and shuttering.

Arguably, by injecting large amounts of cash into a handful of such companies, WSBers are not only saving those companies, but helping save others by puttinf predatory shorters out of business.
Couldn't you say the same for, say washing machines?

You: I just bought a washing machine on Amazon

Amazon: "Here are some ads for more washing machines, in case you're an enthusiastic collector!"
this exists on safari, edge and FF

https://developer.mozilla.org/en-US/docs/Web/API/Document/re...

https://developer.mozilla.org/en-US/docs/Web/API/Storage_Acc...

on safari, it's basically the only way to get access to third party cookies in an iframe since safari 13. I wish other browsers (chrome) would also enable this when third party cookies are disabled. On FF I think the rule is that you have to interact with the site beforehands and you get access automatically, failing that you can use this API. No idea how it works in edge
There are a lot of variables that go into those ad network decisions. Are you in a red state or a localized area where guns are particularly popular? Are you friends likely to buy guns? Do you buy other crossover product categories that gun owners also tend to purchase (ex. certain survival or camping gear)? Lastly, price per bid and volume... If nobody else is targeting you, or not paying enough to target you, the untargeted ads might make their way to your feed if they're bidding high enough or if facebook is simply trying to fulfill their ad volume.
UI suggestion: exaggerate the 'flat/sharp' by drawing the note higher or lower on the stave and turn it green when it is in tune.
It seems like they could fix this by defining pricing based on active users.

I use a SaaS product and they only count users with 10 logins and changes per month as an actual user. This has let us “grow” infrequent users into frequent users.

I think having few barriers between internal user customers and dev is good. Making someone email their ticket in, or not letting someone watch an issue to see when it builds unless they pay $1000/year makes me find products with compatible license models.
It's a casino, and there's almost no barrier to entry any more. No commissions, minimum account size, or requirement to buy whole shares of stock. I think plenty of people are just like, ok, I got $10, $100, my stimulus check, whatever, I'm going to gamble it on something with Robinhood. They don't have capital that they worry about losing, they treat it like the lottery or slot machines. Economic hardship encourages this, not prevents it.

I suspect you're in an "old person" bubble where you see the stock market very differently from the mob on reddit.
The "problem" with that solution is that users are very willing to click any button necessary to achieve their goal, and in any dialog that prompts to allow tracking in order to achieve something else, most people will click allow.

Personally I don't think this is a problem, and people should be allowed to make that choice. But most of HN seems to disagree with me there, and feels that users need to be protected from making choices that could allow them to be tracked
Cookie auto delete is fairly useless. It can’t delete supercookies. Whereas temporary containers takes care of everything.
Calculus comes under a bigger field called "Analysis".

It's in the diagram, but what a terrible layout!

As someone already mentioned, https://tomcircle.wordpress.com/2017/02/15/map-of-mathematic... is way better. The video is totally worth watching.

Edit: Credit to "guerilla" for the link.
I agree Rust is not a panacea and that rewrites create their own set of problems, the only issue with this analysis is assuming 1/10 bugs are memory corruption related.

Both Chrome & Microsoft found about 70% of bugs to be memory safety related. I've heard similar numbers out of FB as well. The math looks a little different with that data.

https://www.chromium.org/Home/chromium-security/memory-safet...

https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
They are spending more money on ads because it's a good time to sell more. People are exposed to enough fear, unrest, and conspiracy theories that many of them only need to see a few ads to make an emotional purchase decision.
Have a look at the logic inside a program called 'Entropytuner', it is used for pianos but it will give you a lot of hints about good monophonic pitch detection.
If by "buying things" that includes buying into pervasive detachment from reality (ie, Q related posts) then maybe it's even worse.
? I’m not sure what the pandemic has to do with this.

I looked at your comment history and you say “in fact” without supporting your opinions _often_ to the point that I laughed.

Also, you edited your original comment which probably led to the downvotes.

I’m assuming you must also correlate the pandemic with your immaturity then.
I don't think it's either/or. Yeah we need to act against companies abusing it, but we also need to be prudent and put locks on our houses when we know there are thieves and spies who would love to sneak inside and take notes on our every move.

What frustrates me the most is that we can't individually disable web api's that provide no value to us. Yeah, that would give greater entropy to fingerprinting, but I'm willing to take that tradeoff if I could prevent webrtc, motion sensing, screen size detection, or web assembly e.g. except on selected whitelisted websites.
Wholeheartedly agreed!
Depending on your market, killing off cheaper plans might barely impact your revenue at all... right up until you stop getting bigger contacts because there's no on-ramp customers to try your services before going all-in.
The short sellers could have jumped as soon as Ryan Cohen and co got on the Gamestop board, but no they continued shorting. I have no sympathy for them, be careful of future calls for regulation of retail investors.
This is what tempers my enthusiasm for WebAssembly - it will undoubtedly be used for all sorts of user-hostile and malicious activity.
Wow, great story I hadn't heard!

> Mauch has been charging $65 a month for symmetrical 50Mbps service, $75 for 250Mbps, and $99 for 500Mbps,

That's less than Comcast consumer rates in Baltimore.
The point i wanted to express is that although LIDAR could be an improvement it is not per se the „way to go“ with ADAS today. Please consider that some, eg Audi, offer ADAS using lidar and it is not nearly as capeable as Teslas system.

Costs matter.

I am very certain that Waymo has no autonomous vehicle today that mist people would be ok to go around their neighbourhood driverless. „Full autonomy“- socially acceptable- does not exist today. Whether it can be done, with or without Lidar, remains to be seen.
Edward Jenner
Shorts have no theoretical stop-gap for losses. Would it be wiser take a long position on a put option?
Get them the same resolution. I have a Dell laptop with Ubuntu Mate and two 4k screens. It has been running wonderfully for at least five years. I'd never go back to 1080.
I'm not sure how it affects your argument, but in the interest of accuracy (and presuming I haven't missed hearing about another controversial documentary) I'll mention that "Cuties" is not a documentary, but a fictional feature film. I haven't seen either.
Three decades of free software that generated billions upon billions of revenue and a big part of existing infrastructure is built upon is far from "wall to wall toxic waste".

I'm not a fanboy for the sake of it, but you're being a little over your head here.
Upvoted, but I am not sure tokopedia is even in the top 10 in Asia.

Also, the fascination with GMV tends to make it looks like high scalability is required. In another HN discussion, someone mentioned about running the database for an ecommerce that had 1 billions GMV a few years back. Assuming a conservative $5 per order, that translates to about 6 orders per second on average.
GotConn Privacy Search Engine
...but doesn't queue jobs
Could skip source control entirely and just mail diffs around all day
That was that thinking in April, but more careful studies are showing that wearer protection is quite high. And that bandanas and neck gaiters do actually offer reasonable protection.

Here's the preprint from Linsey Marr who is considered by many a leader in aerosol risk.

https://www.medrxiv.org/content/10.1101/2020.11.18.20233353v...
> someone will rewrite all GNU/UNIX user land in modern Rust or similar

Or everyone just switches to musl + busybox.
It's nagware.
Rewriting sudo is a weekend project*. Getting people to adopt it is a many-year political campaign.
When I was working in the machine shop business around 2016 another shop owner called our shop asking if we had any work to sub out. I was surprised because his shop was running at max capacity the year before, making gun parts. Apparently when a republican becomes president the gun parts market dries up; when a democrat wins, the market booms.

I think the arms retailers are having a boom right now and have plenty of money for ads.
The biggest myth out there is that FB is somehow detached from the ads they permit on their website because of "it's the algorithm" or "we're just a platform".

It's obviously complete BS.
With LAMBDA, users can now define new functions in the Excel formula language
That is when you have sign in and communication on the server side, not place data in the browser for tracking.
I was thinking an advantage is that you can halt the queue, and/or the queue will pick up where it left off (on the next item in the queue) if power is cut. Not sure that this does that, though.
It’s not much choice when the site will find some way of forcing or tricking you to allow tracking
I have a Parler account. I only put up about ten Parleys on it before it was shut down. (One of them was a video about building houses out of bricks that will last for millennia, as opposed to building out of the junk you find at a home center.) I said nothing even remotely violent.

The idea of collective punishment is about anti-American as you can get.

I think that we are on a dangerous collision course with censorship in this country. What Digital Ocean is doing is every bit as dangerous as what Amazon is doing.

The pen is always mightier than the sword. Violence is never the answer. I still hang on to the hope that these incredibly bad decisions may yet be reversed.

EDIT: downvoting me only gives me further evidence that practical freedom of speech is eroding...
I write text documents for a living. 4k at 60hz is what I need and it works perfectly from Ubuntu Mate on a Dell laptop. I'd never go back to 1080.
If you click the "View More" option at the bottom the scroll region expands to fill the view...but still a confusing UI
My Book of Ideas
Keep in mind that Linux is not the only free software project. Take a look at Blender (for example) which is turning the scene upside down.

And, on the last point: Was there ever any mainstream media coverage of FOSS?
How do you suggest implementing "sign in" without setting a cookie?
If the detachment from reality drives engagement and leaves people in a susceptible state to advertisement, more the better.
Why does facebook do this rather than let third party advertisers advertise? I thought they got most of their money from third party advertisers, not selling their own products.

Note - gun sales are very strong in the US. Antifa / BLM / Armed protestors.
Indeed. They have been clear they want to get into green energy. https://www.shell.com/energy-and-innovation/the-energy-futur... (warning: loads slowly, crashes on iPad):

Shell is aiming to become a net-zero emissions energy business by 2050 or sooner.

We intend to meet our customers’ demand for cleaner energy, keeping in pace with society